Project Explorer: Automatically Digitally Signing an EXE After Building

When a customer reports a bug, we usually fix it immediately and send them a “hot fix”, which is usually just an updated EXE. Because it doesn’t go through our usual build process, the EXE isn’t digitally signed, which can cause issues on some machines. I created a batch file to sign the EXE but most of the time forget to run it before sending the EXE to the customer. Then it occurred to me I could automate that process using Project Explorer.

I created the following program and added it to the Addins subdirectory of the folder where Project Explorer exists:

lparameters toParameter1, ;
    tuParameter2, ;
    tuParameter3
local laStack[1], ;
    lnRows, ;
    lnI, ;
    lcApp, ;
     lcDescription, ;
    lcCommand, ;
    lcFolder, ;
    loAppRun

* If this is a registration call, tell the addin manager which method we're
* an addin for.

if pcount() = 1
    toParameter1.Method = 'AfterBuildProject'
    toParameter1.Active = .T.
    toParameter1.Name   = 'Sign EXE after building'
    return
endif

* This is an addin call, so if we built an EXE, sign it.

if tuParameter2 = 3
    lnRows = astackinfo(laStack)
    for lnI = 1 to lnRows
        if 'projectexplorerui.vct' $ laStack[lnI, 2]
            lcApp = fullpath('..\projectexplorer.app', laStack[lnI, 2])
        endif 'projectexplorerui.vct' $ laStack[lnI, 2]
    next lnI
    lcDescription = inputbox('Description', 'Description for EXE')
    text to lcCommand textmerge noshow pretext 1 + 2
    "SignToolPath\signtool.exe" sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /f CertificatePath /d "<<lcDescription>>" /p Password "<<tuParameter3>>"
    endtext
    lcFolder = justpath(tuParameter3)
    loAppRun = newobject('APIAppRun', 'APIAppRun.PRG', lcApp, lcCommand, ;
        lcFolder, 'HID')
     loAppRun.LaunchAppAndWait()
endif tuParameter2 = 3
return .T.

Substitute SignToolPath with the path to SignTool.exe, CertificatePath with the path and name of the certificate file, and Password with the password.

This program is a Project Explorer addin that’s called after a project is built successfully. This code checks whether it was an EXE (we’re not going to sign an APP) and if so, finds the location of Project Explorer so it can use the built-in APIAppRun class to call SignTool.exe to digitally sign the EXE.

Now, whenever I build an EXE in Project Explorer, it’s automatically signed so I don’t have to remember to do it.